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Objective 

To determine whether the Department of Health adequately monitors designated health 
departments’ oversight of food service establishments to ensure they comply with the State 
Sanitary Code to prevent or mitigate outbreaks of foodborne illness. This audit covers the 
period January 1, 2014 through April 12, 2018. 

About the Program 

The Centers for Disease Control and Prevention (CDC) estimates that, each year, roughly 48 
million people in the United States - or 1 in 6 Americans - get sick from a foodborne illness. 
Compliance with health codes and guidelines can help protect public health and prevent some 
of these illnesses. 

The Department of Health (Department), through its Division of Environmental Health 
Protection, is responsible for overseeing New York State’s more than 90,000 food service 
establishments (Establishments) and for ensuring that those Establishments are adhering to 
the State Sanitary Code (Code). The Department administers regulatory programs designed 
to minimize environmental health threats and provides policy directives and implementation 
guidance to county and city health departments and State regional and district offices. The 
Department’s oversight is implemented at the local level through four regional offices (Capital, 
Central, Western, and Metropolitan) responsible for county and city health departments and 
the Department’s district offices. Thirty-six counties and the City of New York have a health 
department; the 21 counties without full-service health departments rely on the Department’s 
district offices. Hereafter, we collectively refer to the county and city health departments, 
including the New York City Department of Health and Mental Hygiene, and Department district 
offices as designated health departments. These departments are responsible for permitting 
and inspecting Establishments to ensure compliance with the Code and investigating 
complaints and reports of foodborne illness. They must also notify the Department when 
they initiate an investigation of a foodborne illness outbreak or when an unusual prevalence 
of foodborne illness is identified. Consumers may submit food-related complaints against 
Establishments to their designated health department. The Department requires each 
designated health department to investigate all complaints and reports of foodborne illness in 
an accurate, complete, and timely fashion. Designated health departments must maintain a 
surveillance system to record complaints and identify possible foodborne illness outbreaks. 

Key Findings 

■ The Department has implemented inspection, complaint and outbreak investigation, 
and enforcement procedures and requirements for designated health departments to 
follow to ensure compliance with the Code to prevent or mitigate outbreaks of foodborne 
illness. However, designated health departments have not conducted inspections as 
frequently as recommended, and not all high-risk Establishments are inspected by more 
highly trained inspectors, as the Department recommends, hindering the Department’s 
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oversight ability. Department reports show that high-risk Establishments were inspected 
twice a year, as recommended, only 44 percent of the time. Another report showed the 
percentage of high-risk Establishments inspected by more highly trained inspectors 
steadily decreased from 76 percent in 2014 to 64 percent in 2017. 

■ Designated health departments are not adequately ensuring enforcement of, or 
documenting justifications for the absence of, actions to address Category I public health 
hazards, as directed by the Department. Overall, of the 984 Category I violations, 717 
(73 percent) resulted in no enforcement action, and for 590 of the 717 (82 percent), 
inspectors also did not provide justification for the lack of enforcement actions. 

■ We found systemic issues with the quality of data the Department relies on to carry out its 
oversight of Establishments. Error-prone reporting and problems transmitting data from 
designated health departments to the Department’s Environmental Health Information and 
Permitting System (EH I PS) have resulted in data inaccuracies. Such deficiencies, along 
with inconsistent use of reporting functions, diminish the Department’s ability to conduct 
useful analyses and to provide meaningful information to designated health departments 
- information that could help designated health departments focus their limited resources 
on areas of highest risk to consumers. 

Key Recommendations 

■ Implement procedures to incorporate periodic data analysis and consistent use of EHIPS 
reporting mechanisms to: 

■ Assess the performance of designated health department functions that need 
improvements; 

■ Identify patterns and/or areas of concern involving non-compliance with the Code; and 

■ Provide information to regional offices and designated health departments to assist 
them in the most effective allocation of staff resources (i.e., to more effectively assign 
certified inspectors and assess risk levels of Establishments). 

■ Ensure that designated health departments take enforcement action for Category I 
violations or document justification for not doing so, especially for Establishments that 
demonstrate a pattern of repeated violations. 

■ Take steps to improve the accuracy and completeness of EHIPS data including, but not 
necessarily limited to: 

■ Implementing procedures for input, quality assurance, and utilization of information; 
and 

■ Developing fixes for data errors and the inability to transmit data from designated 
health departments to EHIPS. 
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Office of the New York State Comptroller 
Division of State Government Accountability 

April 5, 2019 

Howard A. Zucker, M.D., J.D. 

Commissioner 
Department of Health 
Corning Tower 
Albany, NY 12237 

Dear Dr. Zucker: 

The Office of the State Comptroller is committed to helping State agencies, public authorities, 
and local government agencies manage government resources efficiently and effectively. By 
so doing, it provides accountability for tax dollars spent to support government operations. 

The Comptroller oversees the fiscal affairs of State agencies, public authorities, and local 
government agencies, as well as their compliance with relevant statutes and their observance 
of good business practices. This fiscal oversight is accomplished, in part, through our audits, 
which identify opportunities for improving operations. Audits can also identify strategies for 
reducing costs and strengthening controls that are intended to safeguard assets. 

Following is a report of our audit entitled Oversight of Food Service Establishments. The audit 
was performed pursuant to the State Comptroller’s authority as set forth in Article V, Section 1 
of the State Constitution and Article II, Section 8 of the State Finance Law. 

This audit’s results and recommendations are resources for you to use in effectively managing 
your operations and in meeting the expectations of taxpayers. If you have any questions about 
this report, please feel free to contact us. 

Respectfully submitted. 



Division of State Government Accountability 
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Glossary of Terms 


Abbreviation 

Description 

Identifier 

CDC 

Centers for Disease 

Control and Prevention 

Federal Agency 

Code 

New York State Sanitary 
Code 

Key Term 

Department 

Department of Health 

Auditee 

Designated health 
departments 

County and city health 
departments, including 

New York City Department 
of Health and Mental 
Hygiene, and Department 
district offices 

Key Term 

EHIPS 

Environmental Health 
Information and Permitting 
System 

Key Term 

Establishments 

Food service 
establishments 

Key Term 

FSIO 

Food Service Inspection 
Officer 

Key Term 
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Background 


Foodborne illness is triggered by consuming contaminated food and 
beverages. Common contaminants include bacteria, viruses, and parasites. 
Symptoms may include nausea, vomiting, diarrhea, or fever, and onset of 
illness ranges from hours to days. Because symptoms can mimic the flu and 
appear long after the consumption of contaminated food, foodborne illnesses 
are not always reported or even correctly identified. While everyone is at 
some risk, the potential to become ill and the effects of those illnesses can be 
more serious for vulnerable populations such as infants, the elderly, pregnant 
women, and persons with compromised immune systems. Effects may not 
be limited to the initial symptoms, sometimes leading to chronic disease, 
permanent disability, or even death. 

The Centers for Disease Control and Prevention (CDC) estimates that, each 
year, roughly 48 million people in the United States - or 1 in 6 Americans 
- get sick from a foodborne illness. Of those, 128,000 are hospitalized and 
3,000 die. Compliance with health codes and guidelines can prevent some of 
these illnesses, possibly saving lives and protecting public health. 

The Department of Health (Department), through its Division of Environmental 
Health Protection, is responsible for overseeing New York State’s more 
than 90,000 food service establishments (Establishments) and for 
ensuring that those Establishments are adhering to the State Sanitary 
Code (Code). The Department administers regulatory programs designed 
to minimize environmental health threats, and provides policy directives 
and implementation guidance to county health departments and State 
regional and district offices. In addition to Establishments, the Division of 
Environmental Protection, among other responsibilities, oversees public 
beaches, swimming pools, and aquatic spraygrounds; hotels and motels; 
tanning facilities; tattoo facilities; and campgrounds and agricultural 
fairgrounds. 

The Code requires Establishment owners and operators to run their facilities 
in a manner that avoids imminent health hazards (i.e., violations that make it 
probable that the Establishment’s continued operation or the food and/or drink 
served could injure the health of the consumer or the public). The Department 
issues various procedural guidance documents to regional and district offices, 
as well as city and county health departments, to help ensure Establishments 
are operating in compliance with the Code. 

The Department’s oversight is implemented at the local level through four 
regional offices (Capital, Central, Western, and Metropolitan) responsible 
for county and city health departments and the Department’s district offices. 
Thirty-six counties and the City of New York have their own full-service health 
departments; the remaining 21 counties are covered by the appropriate 
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Department district offices. County and city health departments, including 
the New York City Department of Health and Mental Hygiene and the 
Department’s district offices (collectively referred to as designated health 
departments), are responsible for permitting and inspecting Establishments to 
ensure compliance with the Code. 

Designated health departments are responsible for investigating complaints 
and reports of foodborne illnesses and must notify the Department when 
they initiate an investigation of a foodborne illness outbreak (i.e., a confirmed 
case of two or more people becoming ill from the same contaminated 
food) or when an unusual prevalence of foodborne illness is identified. The 
Department directs consumers to submit complaints to their designated health 
department and requires each health department to investigate all complaints 
and reports of foodborne illness in an accurate, complete, and timely fashion. 
Designated health departments must maintain a surveillance system to record 
complaints and identify possible foodborne illness outbreaks. 

Not all Establishments present the same risk of causing foodborne 
illnesses, and the Department assesses risk level based on the nature of 
Establishments’ menus and populations served. The Department groups 
Establishments into one of three risk levels: high, medium, or low risk, as 
shown in the following table. 


Department Risk Levels by Establishment Type 


Risk 

Level 

Risk Factors 

Establishment Type 

High 

Serve potentially hazardous foods with 
advanced preparation of complex food 
items involving cooling and reheating 

• Restaurants (non-fast food) 

• Schools that prepare food 

• Diners 

Medium 

Serve potentially hazardous foods 
limited to cook-and-serve operations 
generally not including cooling and 
reheating 

• Fast-food restaurants 

• Pizza parlors 

• Short-order establishments 

• Schools receiving prepared 
foods 

Low 

Serve very few potentially hazardous 
foods, and those served are generally 
prepackaged 

• Bars 

• Taverns 

• Retail bakeries 

• Coffee shops 
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The Department establishes inspection frequencies based on risk level. 
High-risk Establishments should be inspected, on average, twice per 
year; medium-risk, once per year; and low-risk, once every two years. 
Additionally, the Department recommends that individuals inspecting high- 
risk Establishments receive advanced training and obtain a Food Service 
Inspection Officer (FSIO) Level 1 certificate, which indicates proficiency in 
uniform food service inspection techniques. Federal guidance outlined in the 
Food and Drug Administration’s Food Code suggests the use of additional 
criteria - such as food establishments’ history of violations and code 
compliance - for determining inspection frequency. However, the Department 
does not consider such factors in its risk assessment. 

The Department categorizes Code violations as either critical or non-critical. 
Critical violations pose the greatest risk of health hazards to the public. 

Critical violations must be immediately corrected or the establishment must 
cease operations. Critical violations that pose the greatest risk to the public 
are categorized as Category I public health hazards and include issues with 
food from unapproved sources, adulterated or contaminated food, potentially 
hazardous foods stored out of appropriate temperature ranges, exposure 
to foods by ill persons, sewage concerns, and inadequate drinkable water 
supplies. 

Designated health departments must take action against Establishments for 
all Category I public health hazards and, to the extent formal enforcement 
action is not initiated, they should document their justifications for not doing 
so. Lesser hazards require no enforcement actions. Formal enforcement 
measures may include administrative hearings, formal stipulations, fines, 
court actions, and/or closures. 

The Department monitors Establishments throughout the State through its 
Environmental Health Information and Permitting System (EHIPS). EHIPS 
serves as a central repository for inspection data - including violations - for 
designated health departments. The Department allows municipalities to use 
different systems to capture inspection data; however, the systems must be 
capable of loading the information into EHIPS. Suffolk, Erie, and Westchester 
counties and New York City utilize their own information systems and upload 
their data into EHIPS quarterly. 

The Department reported that, between January 1, 2014 and September 18, 
2017, designated health departments completed over 417,000 inspections 
representing 96,761 establishments. These inspections resulted in more than 
1.2 million violations of the Code, including over 200,000 critical violations 
(16.7 percent) and over 38,000 imminent health hazards (3.2 percent). 
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Audit Findings and Recommendations 


The Department has implemented inspection, complaint and outbreak 
investigation, and enforcement procedures and requirements for designated 
health departments to follow to ensure compliance with the Code and to 
prevent or mitigate outbreaks of foodborne illness. However, designated 
health departments have not been able to conduct inspections as frequently 
as recommended, hindering the Department’s oversight ability. Additionally, 
not all high-risk Establishments are inspected by FSIO Level 1 certified 
inspectors, as the Department recommends. 

Designated health departments are also not adequately ensuring enforcement 
of, or documenting justifications for the absence of, actions to address 
Category I public health hazards. We reviewed 984 Category I violations 
cited in calendar years 2016 and 2017 at ten designated health departments 
to determine whether the designated health departments were taking formal 
enforcement actions. Overall, 717 Category I violations (73 percent) resulted 
in no enforcement action. The designated health departments could not 
provide documented justifications for lack of enforcement actions for 590 of 
the 717 violations (82 percent). 

Additionally, we found systemic issues with the quality of data the Department 
relies on to carry out its oversight of Establishments. Error-prone reporting 
and problems transmitting data from designated health departments to EHIPS 
have resulted in data inaccuracies that render the data unreliable, hindering 
the Department’s ability to monitor designated health departments’ inspection 
activities and ensure Code compliance. Additionally, regional offices 
inconsistently utilize the reporting functions within EHIPS, further limiting its 
usefulness as a monitoring tool. 

Because not all designated health departments complete all inspections 
recommended by the Department (with many attributing their shortfalls to 
a lack of resources, particularly staffing), effective data analysis could help 
them target their limited resources to areas of greatest need or at highest 
risk. Robust data and systems are key tools for constructively analyzing 
risks, and their effective use could enable the Department to more accurately 
identify performance strengths and weaknesses within designated health 
departments. 

We found that designated health departments have effective systems for both 
responding to foodborne illness outbreaks and for protecting the public from 
further contamination. However, a lack of guidance from the Department has 
created inconsistencies in complaint investigations across designated health 
departments. 
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Inspections and Enforcement 

Inspections 

Designated health departments have not been able to conduct inspections 
as frequently as recommended, and not all high-risk Establishments 
are inspected by FSIO Level 1 certified inspectors as the Department 
recommends, hindering the Department’s oversight ability. Despite limitations 
in the data, the Department provided a report about the frequency of 
inspections at high-risk Establishments (excluding Suffolk County and New 
York City) for calendar years 2014 through 2017. This report showed high- 
risk Establishments were inspected twice a year, as recommended, only 
44 percent of the time. Another report showed the percentage of high-risk 
Establishments inspected by FSIO Level 1 certified inspectors steadily 
decreased from 76 percent in 2014 to 64 percent in 2017. 

Designated health departments largely attributed their inspection shortfalls 
to a lack of resources, such as staffing (e.g., staff vacancies). Additionally, 
officials stated competing program responsibilities and fluctuations in activity 

- such as increased inspections of children’s camps during summer months 

- have also contributed to performance shortfalls. Similarly, regional office 
staff have expressed that staffing shortfalls limit their ability to adequately 
monitor and assist designated health departments. In some regional offices, 
the Department has few regional field coordinators (who work directly with 
designated health departments) to observe and assess compliance with State 
standards. For example, the Metropolitan Region (which accounts for about 
75 percent of the Establishments statewide) has only one field coordinator to 
cover New York City and the ten surrounding counties, including all of Long 
Island. 

Improved data and analytics of inspection activity could help the Department 
identify patterns and trends - such as Establishments that could be inspected 
less frequently without significant risk, additional patterns of problems, or red 
flags - which could aid in assessing risks related to inspection activities. The 
results of such analyses, in conjunction with guidance from the Department, 
could help designated health departments allocate their limited resources 
to the areas that pose the highest risk to consumers, ultimately improving 
assurances that Establishments are operating in compliance with the Code. 

Although Department officials stated they do review some EFIlPS data, we 
found their analyses are quite broad and are of limited use to the regional 
offices responsible for direct oversight of the designated health departments. 
Routine and targeted analyses that specifically meet the needs of individual 
designated health departments could be more useful. 
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Department officials stated that EH I PS information indicates the number 
of FSIO Level 1 certified inspectors has been decreasing, consequently 
reducing the inspection rate of high-risk Establishments by certified 
inspectors. In response, the Department revised the process for FSIO Level 1 
certification, streamlining and clarifying defined time frames for completion of 
fieldwork training. Additionally, in 2015, the Department took steps to further 
meet inspection guidelines for high-risk Establishments. Such efforts included 
adding summer staff to assist with the workload and providing cell phones 
and tablets to inspectors to increase inspection efficiency and improve 
communication. 

According to the 2017 report on critical violation rates, the statewide average 
for critical violations per inspection was 0.55, and for non-critical violations, 

3.85 (see the following graph). The Capital Region identified the highest rate 
of critical violations (0.79 per inspection), the Central Region had the lowest 
critical violations rate of 0.46 per inspection, and the Metropolitan Region had 
the highest non-critical violations rate of 4.44 per inspection. 

Per-lnspection Violation Rates (Critical vs. Non-Critical) per Region in 2017 


5 



Capital Central Metropolitan Western Statewide 


■ Critical ■ Non-Critical 

While this data is available to the Department, it is not being used to evaluate 
risk when planning future inspections. Given the risk posed by critical 
violations to public health, the Department should consider factoring the 
number of these violations cited at Establishments into its risk assessment 
for determining the frequency of inspections. Establishments that frequently 
have higher rates of critical violations, regardless of the food they serve or 
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how it is prepared, may demand more attention than those designated high 
risk using the current model. Adding the number of past critical violations or 
related factors (such as Establishments’ responses to past violations) to the 
Department’s considerations for assessing Establishment risk level could 
result in more effective use of limited inspection resources. 

We observed 90 inspections among five district offices covering six 
designated health departments, including New York City. For those 90 
inspections, inspectors cited 1,126 violations, of which 243 (21.6 percent) 
were critical. Generally, we observed inconsistencies in how inspections 
were conducted, indicating additional guidance may be necessary to ensure 
consistency in how inspections are conducted. We found some inspectors 
focused on general sanitary conditions rather than conducting a more risk- 
based inspection. For example, some inspectors focused on conditions that 
would more likely affect the health and safety of consumers, such as dirty 
cutlery or equipment, while other inspectors focused on sink or bathroom 
areas. We also observed some violations that were missed by inspectors 
such as food being stored at the incorrect temperature, produce placed 
directly on the floor, and possible cross-contamination issues. Department 
officials responded that they train inspectors to focus on critical violations and 
the missed violations were non-critical. Additionally, they said the presence 
of more persons allowed for a greater ability to observe these violations. 
Officials stated that when multiple inspectors co-inspect an Establishment 
during training or job shadowing, similarly, more violations are noted. 

Enforcement 

Designated health departments are not adequately ensuring enforcement 
of, or documenting justifications for the absence of, actions to address 
Category I public health hazards. To determine whether the designated health 
departments were taking formal enforcement actions, we reviewed 984 
Category I violations cited in calendar years 2016 and 2017 at ten designated 
health departments. Cverall, 717 Category I violations (73 percent) resulted 
in no enforcement action, and for 590 of the 717 (82 percent), inspectors also 
did not provide justification for the lack of enforcement actions. In response to 
our preliminary findings, designated health departments provided additional 
information about these violations, stating that some were incorrectly 
identified as Category I in EFIlPS due to inspector errors in citing the 
violations. Designated health departments also stated that they took action for 
some of these violations, but did not provide us with more specific information 
about these actions. 

The Department also cannot easily monitor enforcement activities or 
determine if inspectors provide adequate justification for not taking actions 
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to address violations. This information is maintained only by the designated 
health departments, and the Department does not require that it be loaded 
into EHIPS. Nonetheless, over half of the designated health departments 
include this information in EHIPS, with others using their own in-house 
systems. 

Inspectors expressed confidence that other program initiatives - such as 
education - can help achieve Code compliance. Establishments with patterns 
of non-compliance may require stronger consequences, such as fines or 
other enforcement activities, coupled with education to deter poor practices 
and ensure greater Code compliance. However, if the Department does not 
capture this information in EHIPS, it cannot readily identify Establishments 
with patterns of non-compliance for which stronger enforcement might be 
more effective. 

System Data Reliability and Use of Information 
in Reporting 

EHIPS, the Department’s primary system for monitoring designated 
health department activity (including inspections and violations issued to 
Establishments), is critical for ensuring Code compliance. We reviewed 
information in EHIPS and found inaccurate and/or incomplete data. While 
some errors originated from designated health departments’ reporting 
issues, we traced others to flaws in how data is transmitted to EHIPS, data 
entry errors, and designated health departments’ inconsistent recording of 
violations. 

Additionally, there is limited verification of the data entered into EHIPS. Some 
verification should occur (e.g., a review of a small sample of inspection 
reports) during program reviews; however, these assessments are not 
routinely completed and there is no standard for how often they should be 
performed. The Department also does not have written standards for quality 
control or procedures for data utilization for EHIPS. Consequently, there 
is no assurance that the data in EHIPS is accurate or complete, making it 
unreliable for purposes of analysis and informed decision making. Further, 
while the Department has developed report functionalities within EHIPS to 
provide oversight of designated health departments, the Department does not 
consistently use these functions. EHIPS’ usefulness as a monitoring tool is 
diminished by its inconsistent application. 

Data Reliability 

We reviewed EHIPS inspection data for the period January 1,2014 through 
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September 18, 2017 and found it was incomplete and contained errors. 

Typical errors included duplication of inspections and violations, incorrectly 
cited violations, and miscategorized Establishment risk levels. Other issues 
included 13 months of missing data for Suffolk County and aggregated 
information resulting in transmission gaps and insufficient detail. 

Further, due to inconsistencies among the Code and designated health 
departments’ county codes, we found miscategorized critical and non-critical 
violations. For instance, Suffolk’s county code is more stringent than the 
Code. Inspectors do not always differentiate between critical and non-critical 
Code violations because the county code does not differentiate. For example, 
inspectors issued the same citation for observed, actual bare-hand contact 
and the mere potential for bare-hand contact. Actual bare-hand contact is a 
critical Code violation, whereas the potential for bare-hand contact is non- 
critical. Ensuring accurate recording of violations - especially critical violations 
- is important, as that information indicates problems in an Establishment’s 
operating processes that may pose a risk to public health. 

Department officials believe that many of these issues have no substantive 
effect on their ability to use the data. Department staff use EH I PS data on a 
statewide level to evaluate trends in inspection performance, staff training, 
and violations identified and to guide the development of regulations, 
guidance, and training programs. Department staff told us that, when 
necessary, they can work with designated health departments to obtain 
missing data to complete their analysis. The Department also works directly 
with designated health departments to observe and assess compliance 
standards. Despite this established collaboration, prior to the engagement 
of our audit, the Department had not requested the missing months of 
Suffolk County information, nor had Department staff or designated health 
departments identified or corrected any of the data inaccuracies. Department 
officials stated they became aware of Suffolk County’s issue with uploading 
data in the summer of 2017, and they believe it occurred due to a lack 
of resources. The Department continues to work with Suffolk County to 
resolve the issue. Nonetheless, as the EHIPS data remains incomplete and 
inaccurate, the usefulness of analysis the Department may have performed to 
ensure Establishments’ and designated health departments’ Code compliance 
is diminished. 

Use of EHIPS Data in Reporting 

The Department has developed the framework, including report functionalities 
within EHIPS, to monitor designated health departments’ oversight of 
Establishments’ compliance with the Code. While there is a user manual that 
identifies reporting tools designated health departments may utilize, there 
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are no written procedures or guidance on how regional offices or designated 
health departments should be using information in EHIPS to monitor Code 
compliance. Consequently, regional offices are not consistently using these 
functions or the EHIPS data. Reporting information on issues such as agency 
goals and employee concerns to management helps promote accountability 
for actions and decisions, but only when it is consistent, timely, and relevant 
to its users. The inconsistent use of the available reporting functions 
diminishes EHIPS’ usefulness as a management tool to obtain current, 
meaningful information on designated health departments to monitor program 
compliance. 

EHIPS is capable of producing reports that can assist the Department in 
monitoring designated health departments’ oversight of Establishments’ 
compliance with the Code and indicate where additional technical assistance 
or training is needed. For example. Department officials can run reports to 
determine if high-risk Establishments have been inspected by FSIO-certified 
inspectors or to determine inspection backlogs. Although EHIPS has the 
functionality to generate reports on inspection data (including on a statewide 
basis), which can be used by regional offices to complete comprehensive 
reviews of designated health departments to monitor performance and 
compliance with the Code, this is not generally done. 

For calendar years 2014 through 2017, the Capital Region (the regional office 
that most heavily used EHIPS’ reporting capabilities) conducted 23 program 
reviews using EHIPS’ reporting capabilities to analyze various aspects of 
performance, including total inspections, number of second inspections for 
high-risk Establishments, complaints received and resolved, and number of 
outbreaks. The Metropolitan Region conducted only two such reviews, and 
the Central and Western Regions conducted none. The Western Region, 
however, did use certain types of reports on an as-needed basis (e.g., 
number of Establishments inspected by FSIO-certified inspectors). 

Investigations of Outbreaks and Compiaints 

Based on our review of a sample of outbreaks at eight designated health 
departments, we found that they had effective systems in place to respond 
to the foodborne illness outbreaks and protect the public from further 
contamination. However, a lack of guidance from the Department has created 
inconsistencies in complaint investigations across the designated health 
departments. 

The Department has developed policies and procedures for designated 
health departments and regional offices for investigating foodborne illness 
outbreaks. These procedures outline inspectors’ responsibilities and help 
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them to consistently identify the pertinent information they should record. 

We reviewed the actions taken for 39 of 85 outbreaks at eight designated 
health departments and found the outbreaks were effectively investigated 
to determine the source of the outbreak, prevent further contamination, and 
educate operators to prevent future outbreaks. Additionally, the Department 
provided statewide training to designated health departments on how to 
investigate and respond to illness complaints based on standards set forth 
by the Council to Improve Foodborne Outbreak Response (a multidisciplinary 
collaboration of national associations and federal agencies - co-chaired 
by the Council of State and Territorial Epidemiologists and the National 
Association of County and City Health Officials - that works to detect, 
investigate, control, and prevent foodborne disease outbreaks). New York 
City also undertook a pilot program to analyze social media sites to identify 
possible complaints involving foodborne illnesses. 

The Department, however, does not provide similarly detailed procedures 
for investigating complaints to designated health departments. Specifically, 
it does not define what constitutes an accurate, complete, and timely 
investigation. As such, we found designated health departments implement 
widely varying complaint investigation processes. Although specific complaint 
circumstances might dictate how a designated health department proceeds, 
a general framework could lead to more consistent investigations and record 
keeping. This consistency would assist with the Department’s review of the 
timeliness, type, and severity of complaints statewide, possibly identifying 
best practices or areas of improvement in complaint investigations. 

We reviewed a sample of 567 complaints between 2016 and 2017 for ten 
designated health departments and found that each had surveillance systems 
in place, but each also had different methods to investigate complaints. 

For example, some designated health departments use their epidemiology 
departments to prioritize complaints before initiating inspections. Based on 
information such as incubation periods (the time between the consumption of 
food and illness symptoms), the epidemiology departments may determine 
that some complaints do not warrant investigation. Other designated health 
departments do not have or might not utilize their epidemiology departments, 
conducting inspections for all complaints instead. Department officials 
stated they are developing a new complaint system, which they will require 
designated health departments to use. The new system should assist the 
Department in analyzing complaint and outbreak information. 
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Recommendations 


1. Implement procedures to incorporate periodic data analysis and 
consistent use of EHIPS reporting mechanisms to: 

■ Assess the performance of designated health department functions 
that need improvements; 

■ Identify patterns and/or areas of concern involving non-compliance 
with the Code; and 

■ Provide information to regional offices and designated health 
departments to assist them in the most effective allocation of staff 
resources (i.e., to more effectively assign FSIO-certified inspectors 
and assess risk levels of Establishments). 

2. Ensure that designated health departments take enforcement action 
for Category I violations, or document justification for not doing so, 
especially for Establishments that demonstrate a pattern of repeated 
violations. 

3. Take steps to improve the accuracy and completeness of EHIPS data 
including, but not necessarily limited to: 

■ Implementing procedures for input, quality assurance, and utilization 
of information; and 

■ Developing fixes for data errors and the inability to transmit data from 
designated health departments to EHIPS. 

4. Develop procedures that provide a basic framework for complaint 
investigations to improve consistency and standardize the information 
recorded for investigations. 
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Audit Scope, Objective, and Methodology 


The objective of our audit was to determine whether the Department 
adequately monitors designated health departments’ oversight of 
Establishments’ compliance with the Code to prevent or mitigate outbreaks of 
foodborne illness. This audit covers the period January 1, 2014 through April 
12, 2018. 

To achieve our audit objective, we interviewed officials from the Department 
and designated health departments. We reviewed and gained an 
understanding of the Code and Department policies and procedures. We 
became familiar with, and assessed the adequacy of, internal controls related 
to the Department’s monitoring of designated health departments’ oversight of 
Establishments’ compliance with the Code. 

We obtained and analyzed inspection data from EH I PS for the period January 
1, 2014 to September 18, 2017 to determine the reliability and accuracy of the 
data. We found instances of inaccurate or incomplete information in EHIPS. 
Therefore, we deemed the data to be unreliable and limited our reliance on 
the data to support our audit findings, using hard copy records wherever 
possible and qualifying the reliability of the data in the report when it was 
used. We judgmentally selected designated health departments to assess 
the Department’s oversight and the reliability of the EHIPS inspection data. 
Overall, we selected 13 designated health departments, including 7 counties, 

5 district offices, and New York City. We selected larger designated health 
departments with at least one district office in each of the Department’s four 
regions. We also selected designated health departments based on certain 
risk factors, including those with their own information systems and low rates 
of critical violations. For each designated health department, we attended 
inspections of high-risk Establishments to observe inspection methods and 
identification and proper citation of violations. We selected inspectors based 
on the designated health departments’ schedule of upcoming inspections 
and inspector availability. In total, we observed 90 inspections (51 conducted 
by city or county health departments and 39 conducted by district offices) 
conducted by 36 inspectors. 

We sampled foodborne illness complaints for 2016 and 2017 for each of 
10 of the 13 designated health departments, including six counties (Erie, 
Nassau, Onondaga, Schenectady, Suffolk, and Westchester), three district 
offices (Geneva, Monticello, and Watertown), and New York City to compare 
complaint surveillance systems across departments. We excluded general 
complaints, such as those related to sanitary conditions, to align with our 
audit objective. For five designated health departments, we selected all illness 
complaints for 2016 and 2017 because there were fewer than 45 complaints 
each year. For the other five designated health departments, we selected 
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a random sample of illness complaints. In total, we reviewed 567 out of 
7,564 illness complaints. Although we selected random samples in certain 
instances, our conclusions cannot be projected to the population of illness 
complaints as a whole. 

For the same ten designated health departments, we reviewed outbreaks 
to assess the effectiveness of investigations and actions taken to mitigate 
the public’s exposure to health risks. We reviewed either all the outbreak 
investigations from each designated health department completed during the 
scope period (due to the designated health department having only a limited 
number of investigations), or selected some from the 2016 and 2017 calendar 
years (for designated health departments with more investigations). For 
Onondaga and Schenectady counties, we selected all outbreak investigations 
completed during our audit scope (five and two, respectively). For New York 
City, we randomly selected 2 of 23 outbreak investigations in 2016 and 2 
of 20 outbreak investigations in 2017. For Nassau County, we randomly 
selected two of six outbreak investigations in 2016 and the two outbreak 
investigations completed in 2017. For Westchester County, we selected the 
only outbreak investigation from 2016 and randomly selected three of six 
outbreak investigations completed in 2017. For Suffolk County, we selected 
all outbreak investigations in 2016 and 2017 (eight and two, respectively). 

For Erie County, we selected all outbreak investigations in 2016 and 2017 
(two and one, respectively). For the Geneva district office, we selected all 
outbreak investigations in 2016 (two). Geneva did not complete any outbreak 
investigations in 2017. The Watertown and Monticello district offices did not 
complete any outbreak investigations during the audit scope period. In total, 
we reviewed 39 of 85 outbreak investigations. Although we selected random 
samples in certain instances, our conclusions cannot be projected to the 
population of outbreak investigations as a whole. 

Using EH I PS, we identified Category I violations and reviewed enforcement 
actions and compliance with State standards at the same ten designated 
health departments. We reviewed all the identified Category I violations for 
six designated health departments and selected random samples at the other 
four designated health departments. In total, we reviewed 984 of 18,824 
Category I violations. Although we selected random samples in certain 
instances, our conclusions cannot be projected to the population Category I 
violations as a whole. 
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statutory Requirements 


Authority 

We conducted our performance audit in accordance with generally accepted 
government auditing standards. Those standards require that we plan 
and perform the audit to obtain sufficient, appropriate evidence to provide 
a reasonable basis for our findings and conclusions based on our audit 
objective. We believe that the evidence obtained provides a reasonable basis 
for our findings and conclusions based on our audit objective. 

In addition to being the State Auditor, the Comptroller performs certain other 
constitutionally and statutorily mandated duties as the chief fiscal officer of 
New York State. These include operating the State’s accounting system; 
preparing the State’s financial statements; and approving State contracts, 
refunds, and other payments. In addition, the Comptroller appoints members 
to certain boards, commissions, and public authorities, some of whom 
have minority voting rights. These duties may be considered management 
functions for purposes of evaluating organizational independence under 
generally accepted government auditing standards. In our opinion, these 
functions do not affect our ability to conduct independent audits of program 
performance. 

This audit was performed pursuant to the State Comptroller’s authority as set 
forth in Article V, Section 1 of the State Constitution and Article II, Section 8 of 
the State Finance Law. 

Reporting Requirements 

We provided a draft copy of this report to Department officials for their review 
and formal comment. We considered their comments in preparing this final 
report and attached them in their entirety at the end. In general, officials 
agree with our recommendations, but took exception to our reflection of 
how the Department uses its data analysis in both routine assessment of 
performance and ad hoc analysis to address specific concerns. 

Within 90 days of the final release of this report, as required by Section 
170 of the Executive Law, the Commissioner of Health shall report to 
the Governor, the State Comptroller, and the leaders of the Legislature 
and fiscal committees, advising what steps were taken to implement the 
recommendations contained herein, and where recommendations were not 
implemented, the reasons why. 
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Agency Comments 



NEW YORK 


STATE OF 
OPPORTUNITY. 


Department 
of Health 




ANDREW M. CUOMO 

Governor 


HOWARD A. ZUCKER, M.D., J.D. 

Commissioner 


SALLY DRESLIN, M.S., R.N. 

Executive Deputy Commissioner 


March 29, 2019 


Mr. Stephen Goss, Audit Director 

Office of the State Comptroller 

Division of State Government Accountability 

110 State Street - 11"’ Floor 

Albany, New York 12236-0001 

Dear Mr. Goss: 

Enclosed are the Department of Health’s comments on the Office of the State 
Comptroller’s Draft Audit Report 2017-S-62 entitled, “DOH Oversight of Food Service 
Establishments.” 

Thank you for the opportunity to comment. 


Sincerely; 



Sally Dreslin, M.S., R.N. 
Executive Deputy Commissioner 


Enclosure 

cc: Marybeth Hefner 

Diane Christensen 
Jeffrey Hamrnond 
Jill Montag 
Brad Hutton 
Gary Ginsberg 
Michael Cambridge 
Brian Miner 
Ryan Cox 
Jessica Lynch 
Lori Conway 


Empire Stale Plaza, Corning Tower, Albany, NY 12237 [health.ny.gov 
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Department of Health 
Comments on the 
Office of the State Comptroller’s 
Draft Audit Report 2017-S-62 entitled, 

“DOH Oversight of Food Service Establishments” 

The following are the Department of Health’s (Department) comments in response to the Office 
of the State Comptroller’s (OSC) Draft Audit Report 2017-S-62 entitled, “DOH Oversight of Food 
Service Establishments” (the Report). 

Recommendation #1 


Implement procedures to incorporate periodic data analysis and consistent use of EHIPS 
reporting mechanisms to: 

• Assess the performance of designated health department functions that need 
improvements; 

• Identify patterns and/or areas of concern involving non-compliance with the Code; and 

• Provide information to regional offices and designated health departments to assist them 
in the most effective allocation of staff resources (i.e., to more effectively assign FSIO- 
certified inspectors and assess risk levels of Establishments). 

Response #1 

The Report does not reflect a comprehensive understanding of the many ways that the 
Department uses data analysis for both routine assessment of performance measures and ad 
hoc analysis to address specific concerns. However, the Department agrees with the 
recommendation to more routinely assess Local Health Department (LHD) performance. The 
Department has updated the formal, annual review of LHD programs by Regional Office staff 
using a uniform survey tool. Regional Office staff will conduct assessments of LHDs throughout 
2019 and the program review tool will be used to evaluate LHD performance across many aspects 
of the food protection program including: establishment permitting, frequency of inspection of 
establishments, percentage of high-risk inspections performed by a certified Food Service 
Inspection Officer, identification and correction of public health hazards, enforcement, and 
foodborne illness complaint investigation. The Department will also review its guidance on 
Regional Office oversight of LHD programs and revise as necessary to ensure that it is current 
and consistent with Department expectations. 

LHDs must prioritize the various inspection activities that fall within the scope of their 
responsibilities. The Report suggests that establishments’ history of compliance should be 
considered when determining the appropriate inspection frequency and recommends that EHIPS 
reporting mechanisms be used to ensure effective allocation of staff resources. The Department 
agrees and is confident that this is already occurring. EHIPS already contains various report 
functions which allow LHDs to use permit and inspection data to effectively implement their food 
protection program. These reports were developed with significant input from LHDs to address 
their data needs. The Department will consider additional information reporting needs of the 
LHDs and the Regions as it works to further improve EHIPS functionality. The Department will 
also consider incorporating compliance-based prioritization into inspection frequency guidance. 
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Recommendation #2 


Ensure that designated health departments take enforcement action for Category I violations, or 
document justification for not doing so, especially for Establishments that demonstrate a pattern 
of repeated violations. 

Response #2 

The Department agrees with the recommendation and acknowledges that LHDs are not always 
either taking enforcement action for Category 1 Public Health Hazards or documenting reasons 
for not doing so. Often the Public Health Hazards are corrected or mitigated at the time of 
inspection. The absence of later enforcement does not further jeopardize public health when 
LHDs utilize other methods to educate operators and ensure future compliance. The Department 
will review its guidance on enforcement, provide clarification as necessary, and monitor LHD 
enforcement actions as part of program reviews by Regional staff as discussed in 
Recommendation #1. 

Recommendation #3 


Take steps to improve the accuracy and completeness of EHIPS data including, but not 
necessarily limited to: 

• Implementing procedures for input, quality assurance, and utilization of information; and 

• Developing fixes for data errors and the inability to transmit data from designated health 
departments to EHIPS. 

Response #3 

The Report identifies certain inaccuracies and inconsistencies in inspection data entered or 
transferred into the Department’s Environmental Health Information and Permitting System 
(EHIPS), including issues with Suffolk County not effectively providing inspection data to the 
Department. Suffolk County has since resolved the issues associated with data transfer and the 
missing data is now available. The Department will continue to monitor and ensure timely 
transmission of facility and inspection data by all counties using data transfer methods. 

Data transfer issues aside, the number of inaccuracies identified were relatively few and do not 
significantly impact the Department’s ability to evaluate statewide trends. However, the 
Department agrees that it is important to minimize data inaccuracies. One major initiative seeking 
to improve data quality that the Department is undertaking, is the implementation of electronic 
inspection forms, which reduces data entry steps necessary to import data to EHIPS. The 
Department is committed to expanding the use of electronic inspection reports throughout its 
programs and encouraging their use across all LHDs. 

Recommendation #4 


Develop procedures that provide a basic framework for complaint investigations to improve 
consistency and standardize the information recorded for investigations. 
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Response #4 

The Department does not differentiate between foodborne illness complaint and outbreak 
investigations. Standard procedures and guidance for investigation of illness complaints are 
provided to LHDs as part of the Department’s outbreak investigation guidance since many 
foodborne outbreaks are identified through the investigation of foodborne illness complaints. 
Each LHD is required to develop and maintain a surveillance system to record complaints and 
identify possible foodborne disease incidents/outbreaks, verify the incident/outbreak and notify 
the Department Regional Office if an outbreak is identified. More prescriptive standardization of 
complaint/outbreak investigation procedures is impractical because LHDs differ in their 
organizational structure and available resources. 

As noted in the Report, the Department is developing a statewide complaint system which will 
provide a central reporting mechanism to be accessed and monitored by both environmental 
health and communicable disease staff at the local and state level. The Department is also 
revising its outbreak investigation guidance to include more robust technical reference material in 
addition to the existing procedural guidance. 
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